aecelen/ktor-xxe-poc

GitHubRepository PoCExploit

PoC files

16 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A proof-of-concept exploit for CVE-2023-45612, an XXE vulnerability in JetBrains Ktor. The artifact includes a vulnerable Ktor server application and a Python script that sends an XXE payload to read local files.

Backdoor review

No backdoor observed in reviewed code

The repository is a proof-of-concept for CVE-2023-45612 (XXE in Ktor). All reviewed source files implement a minimal Ktor server with a vulnerable XML endpoint and a Python test script that sends a benign request and an XXE payload. No backdoor, concealed executable behavior, or operator-directed harm is present in the supplied text evidence.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesKotlinPython
Target softwareJetBrains Ktor
Attack typesXXE
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains a Python script (test.py) that actively sends an XXE payload to a vulnerable server endpoint to exfiltrate local file contents, which constitutes exploitation code.

test.py:22-30

Requirements

  • A running instance of the vulnerable Ktor server on localhost:8080.README.md:15-25

Observed behavior

  • Sends a valid XML request to the /student endpoint.test.py:6-12
  • Sends an XML payload containing an external entity definition that attempts to read a local file (/etc/passwd or c:/windows/win.ini).test.py:22-30
  • The server deserializes the XML payload using a vulnerable ContentNegotiation configuration.src/main/kotlin/Serialization.kt:7-10src/main/kotlin/Routing.kt:18-20
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability Demonstration
XXE payload in test.py reads local files via external entityThe PoC demonstrates the CVE-2023-45612 vulnerability by sending an XML payload with a SYSTEM entity referencing a local file path.test.py:22-29
Vulnerable Configuration
ContentNegotiation plugin installed with xml() without disabling external entitiesThe server configuration in Serialization.kt enables XML content negotiation with default settings, which is the vulnerable configuration described in CVE-2023-45612.src/main/kotlin/Serialization.kt:7-10
Review boundaries

What the analysis did not establish

  • Two binary files (gradle-wrapper.jar, gradlew) were not inspected.
  • The analysis is based solely on the provided text evidence; the code was not executed.
  • Two binary files (gradle-wrapper.jar and gradlew) were flagged as BINARY and not analyzed; they are standard Gradle wrapper files but their contents were not inspected.
  • Seven additional text files in the repository were not included in the evidence packet and were not reviewed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1